Facebook could face €100,000 fine for holding data that users have deleted

Social network will be audited by Irish data protection commissioner after Austrian law student registers 22 complaints Facebook could face a fine of up to €100,000 (£87,000) after an Austrian law student discovered the social networking site held 1,200 pages of personal data about him, much of which he had deleted. Max Schrems, 24, decided to ask Facebook for a copy of his data in June after attending a lecture by a Facebook executive while on an exchange programme at Santa Clara University in California. Schrems was shocked when he eventually received a CD from California containing messages and information he says he had deleted from his profile in the three years since he joined the site. After receiving the data, Schrems decided to log a list of 22 separate complaints with the Irish data protection commissioner, which next week is to carry out its first audit of Facebook. He wrote to Ireland after discovering that European users are administered by the Irish Facebook subsidiary. A spokeswoman for the commissioner confirmed its officers would be investigating alleged breaches raised by Schrems as part of the audit. If the commissioner decides to prosecute and Facebook or any employees are found guilty of data protection breaches, the maximum penalty is a fine of €100,000. Among the 1,2000 pages of data Schrems was sent were rejected friend requests, incidences where he “defriended” someone, as well as a log of all Facebook chats he had ever had. There was also a list of photos he had detagged of himself, the names of everyone he had ever “poked”, which events he had attended, which he hadn’t replied to, and much more besides. The information was broken down into 57 categories, including likes, log-ons (a list of when he logged on and which IP address he used) and emails, which included some email addresses Schrems had never personally uploaded to the site but which he assumes were discerned from another user’s profile. “I discovered Facebook had kept highly personal messages I had written and then deleted, which, were they to become public, could be highly damaging to my reputation,” said Schrems in an interview between law lectures on Thursday. “I’m not saying there was anything criminal or forbidden there, but let’s just say that, as someone wanting to work in law, there was stuff which could make it pretty impossible for me to get a job.” By holding on to data its users assumed was deleted, Facebook was acting like “the KGB or the CIA”, said Schrems. “Information is power, and information about people is power over people. It’s frightening that all this data is being held by Facebook. “Of course, they are not misusing it at the moment, but the biggest concern is what happens when there is a privacy breach, either from hackers or from someone inside the firm?” A spokesman for Facebook said in a statement: “Facebook provided Mr Schrems with all of the information required in response to his request. “It included requests for information on a range of other things that are not personal information, including Facebook’s proprietary fraud protection measures, and ‘any other analytical procedure that Facebook runs’. “This is clearly not personal data, and Irish data protection law rightly places some valuable and reasonable limits on the data that has to be provided.” Facebook says any user can download their “personal archive”. But Schrems, on the campaigning website he has set up to encourage others to follow his lead, claims that: “This tool only offers access to a fraction of the data Facebook holds. “It even falls short of providing the amount of data we already received from Facebook.” Facebook Data protection Privacy Austria Social networking Internet Europe Helen Pidd guardian.co.uk

Posted by on October 21, 2011. Filed under News, Politics, World News. You can follow any responses to this entry through the RSS 2.0. You can skip to the end and leave a response. Pinging is currently not allowed.